Every Reward Bends: Security Incentives and the OpenAI Hugging Face Incident